MalwareIntelligence is a site dedicated to research on all matters relating to anti-malware security, criminology computing and information security in general, always from a perspective closely related to the field of intelligence.

29.6.10

n0ise Bot. Crimeware particular purpose for DDoS attacks

DDoS attacks are not a trivial problem, and various web applications in this style, such as BlackEnergy have been used to run campaigns of massive attacks, in the case of BE during the conflict between Russia and Georgia.

The impact of such threats is extremely critical, and under this flag in the circuit enters the business that is channeled through crimeware, a web application called n0ise Bot German origin, although not yet have a good impact on criminal ecosystem, takes on the black market for some time.

n0ise Bot is designed exclusively to recruit zombies and executing attacks Distributed Denial of Service.

It has a minimalist design but offers the information needed to manage the zombies to be used as a means to carry out DDoS attacks.

The commands that can be used through the basic configuration of this crimeware are:
  • Syn-Flood - synflood*Host*Port*Threads*Sockets
  • HTTP-Flood - httpflood*Host*Threads
  • UDP-Flood - udpflood*Host*Port*Threads*Sockets*Packetsize
  • ICMP-Flood - icmpflood*Host*Port*Threads*Sockets*Packetsize
  • Multi Stealer - steal*Link to Uploadscript
  • Download and Execute - downandexe*LinkToFile
  • Visit Page - visit*Link
  • Bot Update - update*LinkToNewBot
  • Remove Bot - remove*Name
The business strategy employed for the sale of crimeware, adds to the tendency to whiten their existence through the advertising displayed across the website "official" crimeware called Coding-Revolutions, which also sell other applications for handling malicious code for "secure communications" under the slogan "Willkommen im Shop von neuen n0ise Malware!" (Something like "Welcome to the new store n0ise malware").

This business model has been used in other opportunities to promote Unique Sploits Pack, YES Exploit System and Mariposa Botnet.

As shown in the image, n0ise Bot cost is € 50 (only the binary without the constructor) and € 250 (binary lifetime including future upgrades) transactions are made through the service paysafecard, a payment system online that leaves no traces of those involved in the transactions.

However, since May 2010 the developer has released the second version (2.1) where the cost of the binary is still € 50 but the lifetime value of this low at € 200, perhaps as a consequence of their lack of impact between computer criminals.


Related information

Ver más

0 comentarios

26.6.10

Brief review of Passenger Admin Panel

If you 5/6 years ago we were talking about control and centralized management of botnets (C&C) via http, when the massive operating botnets through IRC channels, it was seen as a trend.

After the first appearance of the odd kit, demand began to be high but the supply was poor. However, despite having spent several years, today continue to set trends in crimeware and demand remains high but with the difference that the offer is directly proportional.

Under this scenario every day we witness the appearance of any web application that adds to the offer, exclusively designed to feed the demand, facilitate and manage intelligence "assets" (zombies) of offenders. Another concrete example of this trend is Passenger Admin Panel.



As can be seen in terms of images, Passenger is of Russian origin and apparently it's a private version or designed on demand, as there are no references to its development.

It has only three options. The first of these, the statistics panel which centralises information relating to number of zombies (in this case 16.845), number of active zombies (582) - this information is refreshed every 60 minutes - many recruited zombies per day (36) , number of victims during the past 24 pm (7.349), among other data.




The statistics continue to show data about the versions of the bots and the amount of zombies recruited by each affiliate ID with the number of victims who have (in this case there are two affiliated with zombies 16.842 and 3 respectively), status of the module over Interestingly called Putty Grabber with your records and the number of operating systems involved.


Regarding operating systems that are part of the range of victims of this botnet are:

  • Microsoft Windows 2000 Service Pack 3
  • Microsoft Windows Server 2003    
  • Microsoft Windows Server 2003 Service Pack 1 and 2
  • Microsoft Windows Server 2003 R2 Service Pack 1 and 2
  • Microsoft Windows XP
  • Microsoft Windows XP Service Pack 1, 2 and 3
  • Windows XP by Rushen 10.5 Minimal Service Pack 3
  • Windows Vista (TM) Business    
  • Windows Vista (TM) Business Service Pack 1 and 2
  • Windows Vista (TM) Home Basic
  • Windows Vista (TM) Home Basic Service Pack 1 and 2
  • Windows Vista (TM) Home Premium    
  • Windows Vista (TM) Home Premium Service Pack 1 and 2
  • Windows Vista (TM) Ultimate Service Pack 1 and 2
  • Windows Server (R) 2008 Standard Service Pack 2
Passenger can set the task of updating the bot through a previously assigned URL that points to a file called u.php. However, as mentioned above, the most interesting feature for the offender provides Putty Grabber module, which displays specific information and stores sensitive data for each compromised computer.


Undoubtedly, the crimeware is a very critical problem that operates globally and on a large scale, and the constant emergence of alternatives as specified in this is further evidence of this.

Related Information
State of the art in CRiMEPACK Exploit Pack
Siberia Exploit Pack. Another package of explois I...
RussKill. Application to perform denial of service...
JustExploit. New Exploit kit that uses vulnerabili...
DDoS Botnet. New crimeware particular purpose
T-IFRAMER. Kit for the injection of malware In-the...
Fragus. New botnet framework In-the-Wild
Liberty Exploit System. Alternatively crimeware to...
TRiAD Botnet III. Remote administration of multi-p...

Ver más

1 comentarios

23.6.10

State of the art in Eleonore Exploit Pack II

Undoubtedly the crimeware rate exploit pack and malware kit, whether these general purpose, such as ZeuS or as RussKill particular purpose, have become the creme de la creme of computer crime and synonymous with the easy for cybercriminals.

Based on this, one of the fastest growing crimeware over the past six months is Eleonore Exploit Pack. He is currently on the lips of many would-be cyber criminals who use, and safety professionals who have noticed its impact within the crime scene because of its increasingly progressive recruitment of followers, which justifies the reason for investigation.

Earlier this year we gave to know how the developer of this application site was releasing different versions of crimeware and from the final version of the time (1.3.2) to current (1.4.1), things have changed little.


The truth is that, as shown in the image, attack coverage including a considerable number of operating systems, an aspect that also has become a trend for some exploits pack, as the case of Siberia Exploit Pack, until even shares a similar taste to a story in this design.

But again let's review the chronology of the emergence of different versions:

The basis of this botnet is hosted in the U.S., the vendor under the Secured Private Network on ASN22298, it also hosts malware type rogue, fakeAV, some other trojans, variants of ZeuS, even some families Koobface and maintained by business services QuadraNet led by a spammer Israeli named Ilan Mishan, also well known in the offense to give the necessary resources to accommodate hosting activities spam, scam, phishing, pornography, including through other companies such as OC-3 Networks and PacificRack bonded under QuadraNet.




Despite having the C&C in the U.S., the highest rate of activity is in Eastern Europe, just in Ukraine where the largest number of computers whose security has been breached by one of the many exploits that are disseminated Eleonore Exploit Pack.


On the other hand, it's interesting to know the web pages through which refer to the pre-compiled exploits Eleonore. The lists are usually very long and quite varied between subjects, which usually characterize the pages that have sexually explicit content, the spread of FakeAV, casinos and pharmacies online, among others.

Also, another closely linked with the scenario that represents the business of these criminal activities: affiliate programs. In this case, one is promoted for the purchase of web traffic, where the axis of business is to get money through advertising and injected into web pages displayed in popup windows.

Related information
State of the art in Eleonore Exploit Pack
Eleonore Exploits Pack. New Crimeware In-the-Wild
Nueva versión de Eleonore Exploits Pack In-the-Wild
Phishing campaign aimed at players Zynga

Ver más

0 comentarios

28.5.10

Intelligence and operational level by Siberia Exploit Pack

Siberia Exploit Pack is a crimeware, evolution of Napoleon Exploit Pack, which we've done a brief description on another occasion. However, since the time of that description to this day, the landscape has expanded its developer.


In this regard, and while it ends up being one of the bunch, the interesting thing about this crimeware is information provided by their panel of statistics (intelligence for the attacker), by the way very similar to that provided by Eleonore Exploit Pack, which provide data regarding the success of business which has the exploit  pack for recruitment zombie, discriminating on the basis of these data:
  • Countries affected
  • Most exploited Operating Systems
  • Reference domains with the highest percentage by which vulnerabilities are exploited
  • Browsers exploited
  • Pre-compiled exploits in this version of the package
Let me stress (because it's a minor detail) with this collection of information is nothing more than to intelligence, which allows the attacker to know, at first instance:

In the former case, the population of which country is more vulnerable, perhaps because of their level of piracy, which brings to attention the lack of security updates for operating systems and applications, because as we will see to reach exploits, all these are known and have long been concerned with the patch that fixes the vulnerability.

In this case, the first five countries where this crimeware has higher infection rate include the United States, Britain, Canada, Russia and Germany.


The same approach is being pursued with the data we obtained on operating systems "vulnerable" in quotes because, as I said above, the degree of vulnerability of the OS depends directly on a number of aspects that should be covered by hardening, in which an important factor is the implementation of security patches.

For example, the vulnerability in MDAC (Microsoft Data Access Components) from the year 2006 (four years), described in Microsoft Official Bulletin MS06-014. The impact on operating systems have this version of crimeware, we can see in the picture below.


The list of operating systems is large and attacked the three with the highest vulnerability gap belongs to the family of Microsoft (which is obviously due to the massiveness of use), and other MS also.

However, the crimeware cover other non-Windows operating systems, including PlayStation consoles (GNU / Linux or Black Rhino) and Nintendo Wii (ironically a modified version of a GNU/Linux), in the case of OS used and Workstations high-end mobile phones, including:
  • Mac OS
  • GNU/Linux
  • FreeBSD
  • iPhone
  • Windows Mobile
  • Windows CE
  • Pocket PC
  • Symbian OS
Here we are beginning to recognize that criminals have broadened the scope of coverage, incorporating into its portfolio of options exploitation of vulnerabilities (through the browser) and recruitment of zombies on other operating systems used in other computer technologies.

Regarding references, involving nearly 28.000 domains where each of them redirect to another page with malicious content or at least doubtful as:
References to these sites are obtained through an application of such TDS (Traffic Distribution System), also installed on the same server, used to redirect traffic to and from the pages listed in this module of the package. The TDS are widely used for BlackHat SEO.

Moreover, the list is very large as it details the most violated browsers together with their respective versions, they are:
  • Internet Explorer since version 4 through 8
  • Firefox from version 1.0.3 to 3.6b4
  • Opera from version 6.0 to 10.0
  • Opera for Mobile
  • Safari browser
  • PlayStation (Firefox)
  • Pocket PC
  • SeaMonkey 1.1 and 2.0 (Mozilla Suite, which includes a web browser)
  • Nintendo browser
  • IPhone Browser
  • Mobile Phone Browser (Internet Explorer)
  • Chrome from version 1.0 to 6.0
Finally, what are the exploit managers exploit vulnerabilities in all of the above? Well, in principle it should be noted that it's the exploits are designed to exploit known vulnerabilities, as I mentioned above, long-standing.

The most exploited, Java GSB. Less exploited vulnerabilities are those of Adobe Reader PDF files through manipulated.


Undoubtedly the cybercriminals intelligence processes incorporate in their strategies to spread / infection, allowing them to have a comprehensive picture of the situation on the virtual field, increasing the successful outcome in their attacks.

Imagine this data to run campaigns on a "virtual guerrilla war", even to understand the variety of OS environments used in military/government and analyze well the best place to carry out DDoS attacks against critical resources of a State. The thing does not seem so trivial. 


Jorge Mieres
Founder & Director of MalwareIntelligence
Crimeware & Intelligence Analyst Researcher


Related information 
State of the art in CRiMEPACK Exploit Pack
Crimeware-as-a-Service and antivirus evasion schemes
Russian service online to check the detection of malware
Software as a Service on the malware industry
Creating Online PoisonIvy based polymorphic malware

Ver más

0 comentarios

24.5.10

BlackHat SEO Campaign for the thirtieth anniversary of PAC-MAN

Recently, the legendary video game PAC-MAN has completed 30 years of existence and Google has launched a campaign in his honor by placing a banner that allows even play.

However, Google not only benefits from this but also cyber-criminals, who saw in this campaign a new opportunity to attack and have launched another campaign, but the spread of malware through BlackHat SEO (also called SEO Poisoning).

Some other search parameters may include:


pac man 30th anniversary game
pac man 30th anniversary games
pac man 30th anniversary google
pac man 30th anniversary high score
pac man 30th anniversary play
pacman free online 3d
pacman free online addicting games
pacman free online download
pacman free online game for kids
pacman free online game
pacman free online no sound
pacman free online play
pacman free online with no sound
pacman game download
pacman game flash
pacman game for kids
pacman game for wii
pacman game free download
pacman game full screen

Traffic redirected to the download of scareware. In this case, a binary md5 4c9ac21a2730a5e6d8c8018afb517d5e which has a very low detection rate: 6/41 (14.63%).

Among the domains that involves the campaign are:

accu-riteaccounting.com
africanbynature.com
allisonleach.com
bobsclamhut.com
carolfleming.org
carolinasystemsinc.com
d3-store.com
delta-electronic.com
diningbythesea.com
drakeleisure.co.nz
fastripsnackatak.com
fbgartschool.com
gas-consult.com
generationbass.com
gjsdesigns.com
goedkopepc.net
hkiarchitects.com
houndshaveninc.com
hst1066.com
itech-on.pt
jaszmetal.hu
larsonguitar.com
nsc.eypgreece.org
okidouki.com
olivermurr.com
oneaccordclass.org
partrade.net
redhanded.ca
red-partner.com
regionalportauthorityofnwo.org
reillocile.com
reillychiro.com
reynared.com
roseguggenheimer.com
ruders.com
rufiocreative.com
runawaysnail.com
ryangruhn.com
ryanroghaar.com
sacredhaven.com
saevar.com
scxdigitalslots.com
seastromlaw.com
shop.infytel.com
sor-d2.com
s-teamexpert.com
tcgpage.com
tuneoutdropin.com
turtlesplayground.com
william-heise.com

To achieve massify the campaign and get a good PageRank in Google, criminals violated a server hosted on a list of web pages with the titles which make up words that are the subject of regular search. These files are located in a hidden folder, often called the ".files"


Under this scenario, taking into account that these strategies are widely used for the propagation of malware, a good practice is to verify at the root of posting the existence of hidden folders.

Related information
Estrategia BlackHat SEO propuesta por Waledac
Malware propagation through blogging sites format and BlackHat SEO
Campaña de propagación del scareware MalwareRemovalBot

Ver más

0 comentarios

Subscribe to: Posts (Atom)